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Response to the ICO’s Age Appropriate Design: Code 
of Practice for Online Services 


About the Advertising Association 

1. The Advertising Association promotes the role, rights and responsibilities of advertising and its 
impact on individuals, the economy and society. We bring together companies that advertise, 
their agencies, the media and relevant trade associations to combine strengths and seek 
consensus on the issues that affect them. We develop and communicate industry positions for 
politicians and opinion-formers, as well as publish industry research through advertising’s think- 
tank, Credos, including the Advertising Pays series which has quantified the advertising 


industry's contribution to the economy, culture, jobs and society. 


Context 

2. The membership of the Advertising Association is very broad and includes the associations 
representing industry sectors, such as the advertisers (through ISBA), the agencies and 
advertising production houses (through the IPA and APA), all the media (from broadcasters and 
publishers, cinema, radio, outdoor and digital) and marketing services such as direct marketing, 


promotions and market research. 


3. Advertising is a driver of economic growth and competition. Every pound spent on advertising 
returns £6 to GDP. Advertising spend will be over £23.6 billion this year and this results in over 


£142bn to GDP, supporting 1 million jobs across the UK. 


4. According to Deloitte research carried out on behalf of the Advertising Association, the one million 
jobs supported by advertising can be broken down as follows: 
= 350,000 jobs in advertising and the in-house (brands) production of advertising 
= 76,000 jobs in the media sectors supported by revenue from advertising 


= 560,000 jobs supported by the advertising industry across the wider economy 


5. The UK is a world-class hub for advertising, with the latest available figures also showing exports 


of British ad services reached a record high of £6.9bn in 2017. 


6. Advertising is important. It plays a crucial role in brand competition, drives product innovation and 
fuels economic growth. It also provides revenues to fund a diverse and pluralistic media enjoyed 
by children and young people. There are a number of dedicated children’s media providers, and 
much content specifically, for a younger audience. These companies employ a substantial number 
of people and contribute to economic growth and each benefit from the freedom to advertise to 


children responsibly. 
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7. The industry acts in accordance with the advertising CAP (Committee of Advertising Practice) 
codes. The advertising industry is highly regulated and compliance levels are high. The public 
has an easy and well-known route of recourse through the consumer-facing Advertising 
Standards Authority (ASA). The advertising industry is committed to ensuring that the self- 
regulatory system remains fit for purpose and that advertisers market responsibly to children in 


digital as well as traditional media. 


8. Please contact Konrad Shek i for further information on any of 


the points raised in this submission. 


Our Response 
9. We welcome the opportunity to respond to the draft ICO's Age Appropriate Design Code of 
Practice for Online Services consultation. 


10. The Advertising Association supports the UN principle that the best interest of the child should be 
a primary consideration. The advertising industry has responded positively with constructive 
outcomes to independent reviews concerning the welfare of children, such as the Bailey and Bryon 
reviews. The advertising industry recognises that children, particularly younger children, warrant 
special care and attention. This is why extensive and stringent rules are in place across broadcast 


and non-broadcast, and why particular care is taken in advertising in and around children’s media. 


11. The CAP Code, as a matter of principle, ensures that care is taken when featuring or addressing 
children in marketing communications. It also fully recognises that the way that children perceive 
and react to marketing is influence by their age, experience and context of the message. 
Advertising age-restricted products on children’s websites fall foul of the CAP Code and the ASA 
has remit to intervene. The Advertising Association is very open to exploring further ways to 


enhance the protection of children within commercial communications. 


12. However, we strongly recommend that any new restrictions, particularly those that have direct 
impact on ad-funded online services and content, need to be proportionate, enforceable and 
practical. The general concern is that the current scope of the Code is very broad and could have 
an adverse impact on the wider ecosystem, by reducing advertising revenue for many Information 
Society Services (ISSs). This will be detrimental to competition, and put the UK at a distinct 
disadvantage to other markets. Moreover, it could reduce diversity and curb the creativity of 


content and services. 


Services based outside the UK 
13. Page 14 of the draft Code states that if the ISS has a lead supervisory authority other than the 
ICO and does not have a UK establishment, then the Code will not apply. Additionally, given that 
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Article 15 of EU Directive 2000/31/EC (eCommerce Directive)! states that Member States cannot 


impose a general obligation to monitor, it appears there is a clear opportunity for regulatory 


arbitrage. This could conceivably put UK-based ISSs at a competitive disadvantage. 


14. Regulation (EU) 2017/1128 ? on cross-border portability of online content services protects 
the rights of consumers that are temporarily present in a Member State to receive content to 
which they have subscribed to in their Member State of residence. We could find ourselves in a 
situation whereby EU citizens, temporarily living in the UK, could access non-age appropriate 


content under different restrictions to that of UK citizens. 


15. We also note that the draft Code could apply to some services based outside the UK. Enforcing 
the draft Code against non-EEA based ISSs could potentially drain considerable resources of the 
ICO. 


Applying the standards in this code to all children 
16. The draft Code stipulates that the standards should apply to all children, and to all users unless 


there are robust age checks in place to distinguish children from adults. 


17. Identifying children online is notoriously difficult and potentially infringes on the privacy issues that 
the draft Code is trying to prevent. ISSs would therefore be reliant on adults to undergo mandatory 
or voluntary age verification. Introducing the concept of “likely to be accessed by children” sets an 
unnecessarily high bar to prove that no child accesses the content or services even for ISSs not 
directed at children. It could result in two outcomes for risk mitigation: either self-censorship of the 
content or service, and/or wide spread adoption of age verification technology. In the case of the 
former this would mean a curbing or limiting of the freedom of expression. Whereas the latter 
would effectively mean a de facto registration system to use the internet in a less restrictive 


manner. 


18. In either scenario this could lead to a reduction in online traffic to affected ISSs. From an 
advertiser's point of view, this would mean that the ability to reach target audiences would be 
reduced and therefore the return on advertising investment less attractive. From an ad-funded 


publisher's point of view, it would mean a reduction in ad revenue to support their “free” content. 


Making age-verification robust and privacy friendly 
19. The draft Code states that ISSs should make sure that the age-verification mechanisms are robust 


and effective. And be able to demonstrate that children cannot easily circumvent age checks. 


1 EU e-Commerce Directive Article 15 - Member States shall not impose a general obligation on [ISS] providers, when 
providing the services covered by Articles 12, 13 and 14, to monitor the information which they transmit or store, nor a general obligation 
actively to seek facts or circumstances indicating illegal activity 


2 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32017R1128 
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20. What constitutes a “robust” mechanism, and to what standard this is measured against is not 
entirely clear. Trading Standards Institute official advice on online sales of age-restricted products 
makes a similar point: “There is no definitive answer as to what constitutes taking all reasonable 


precautions or exercising all due diligence." 3 


21. Moreover, the internet is global, and social networking is a worldwide phenomenon, the lingering 


question is whether domestic solutions “scale” for globally available networks’. 


22. Virtual Private Networks (VPNs) and Tor Browsers, which are readily available on app stores or 
from websites, easily mask the location of the user, provide a means to evade age-verification 
checks. When asked about the prospect of children using VPNs, the British Board of Film 
Classification (BBFC), the regulator, admitted age-verification was "not a silver bullet"®. There 
appears to be no verified figures on the number of children using VPNs, but there is anecdotal 


evidence that a notable minority of teenagers are using such technology’. 


23. The BBFC and NCC Group, in cooperation with industry, have developed an age-verification 
certification scheme’ to ensure age-verification providers maintain high standards of privacy and 
data security. This is a welcome initiative; however, we note that this scheme is voluntary and 
non-statutory. Additionally, there currently does not appear to be a single framework for age 
verification practices in operation across Europe®. This means that there is a real risk that 
competing standards may emerge that could confuse users and may or may not achieve the same 


standards of privacy. 


24. — It will be extremely important for users that online third-party age verification vendors do not retain 
identifiable data longer than is necessary and this data is not mined or resold. Given their role, 
regulators should be sensitive to the risks that these organisations could develop into “internet 


gatekeepers” and ensure that competition rules are strictly enforced. 


Codes or advice likely to be relevant 
25. We welcome the specific reference to CAP which has published guidance on online behavioural 


advertising and has specific rules on advertising to children. We think it would be appropriate to 
include an explicit reference to the IPSO Editors’ Code of Practice, given the relevance to news 
publishers who are caught under the scope of the draft Code. The IPSO Code upholds high 


standards of journalism, protects individual rights and also has rules on the treatment of children’. 


3 https://www.businesscompanion.info/en/quick-guides/distance-sales/online-sales-of-age-restricted- 
products 

4 Social Networking and Age Verification: Many Hard Questions; No Easy Solutions; A Thierer (2007) 
https://papers.ssrn.com/sol3/papers.cfm?abstract_id=976936. 

5 https://www.ageverificationregulator.com/faq/#19 

5 https://blog.globalwe bindex.com/chart-of-the-day/vpn-users/ 

7 https://www.ageverificationregulator.com/av-certification 

8 https://www.oii.ox.ac.uk/archive/downloads/publications/Effective-Age-Verification-Techniques.pdf 


3 https://www.ipso.co.uk/editors-code-of-practice/ 
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26. Restricting child access to news, which age-profiling or age verification would do, appears to be 
misaligned with the spirit of Article 13 and 17 of the UN Convention of the Rights of the Child 
(UNCRC)"®. 


27. Article 13 states that the child shall have the right to the freedom of expression; this right shall 
include freedom to seek, receive and impart information and ideas of all kinds, regardless of 
frontiers, either orally, in writing or in print, in the form of art, or through any other media of the 
child’s choice. Article 17 recognises the important function performed by the mass media and 
ensures that the child has access and material from a diversity of national and international 
sources [..]. Article 17 (e) also encourages the development of appropriate guidelines for the 
protection of the child from information and material injurious to his or her well-being, bearing in 
mind the provisions of Article 13 [..]. We would argue that the IPSO Code already provides 
appropriate guidelines for publishing news, and that age-profiling and age-verification goes 


beyond this requirement by restricting access. 


28. Ofcom" also regulates editorial content on UK video-on-demand (VOD) services that cover 
platforms such as ITV Hub, All4 (Channel 4) and My5 (Channel 5) among others. On demand 
programme services already have specific rules on protecting the under-18s: specially restricted 
material is made available in a way that under-18s would not normally be able to hear or see it; 
and prohibited material does not appear. The draft Code would effectively be duplicating regulation 


in this area. 


29. We note that the Code does not provide any explanation on the legal relationship between these 


various codes, how conflicts are resolved and whether legal hierarchy is introduced. 


30. We think a better solution would be operate carve outs or exclusions for ISSs that are subject to 
codes that already have specific measures that take the needs of children in account and are 
consistent with the UNCRC. 


31. We would also request further clarification on how this Code relates to the Unfair Commercial 
Practices Directive, Audio-visual Media Services Directive and Competition laws which all have 


relevance to online regulation. 


Providing ‘high privacy’ default settings 
32. The draft Code recommends that privacy settings must be high by default. This is understandable 


in one sense that it takes the best interest of the child into account. However, given the difficulties 
of ISSs in identifying children online, as explained earlier, it seems that lower privacy settings 


could only be lawfully set if all adults were required to go through age-verification checks to prove 


10 https://downloads.unicef.org.uk/wp- 
content/uploads/2010/05/UNCRC_united_nations_convention_on_the_rights_of_the_child.pdf?_ga=2.223 
449179.139368610.1557919107-1434768823.1557919107 


https://www.ofcom.org.uk/tv-radio-and-on-demand/advice-for-consumers/television/video-on-demand 
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that they were not a child. Logically speaking, this would equally apply to households who do not 


even have children. 


33. Needless to say, this would have a profound effect on online behavioural advertising, that relies 
on processing personal data to improve, enhance and personalise the advertising experience. 
Personalised content helps enable recommendations for more suitable content to users, and can 
even help prevent age-inappropriate content from being suggested to the wrong target audience. 
Moreover, advertisers and marketeers would have their ability to measure and evaluate online 
advertising campaigns severely curtailed. Without these metrics in place it would makes it harder 
for advertisers and marketeers to justify ad spend. ISSs that rely on ad revenue to fund their free 


content would ultimately suffer. 


34. |The Code should also recognise that “high privacy” by default does not mean having all settings 
off but ensuring data minimisation; offering users the ability to make informed choices; and giving 


users full control of their privacy settings. 


Conclusion 

35. Advertising is important. It plays a crucial role in brand competition, drives product innovation and 
fuels economic growth. It also provides revenues to fund a diverse and pluralistic media enjoyed 
by children and young people. The general concern is that the current draft of the Code could 
have an adverse impact on the wider ecosystem, by reducing advertising revenue for many ISSs. 
This will be detrimental to competition, and put the UK at a disadvantage to other markets. 


Moreover, it could reduce diversity and curb the creativity of content and services. 


36. We think a better solution would be operate carve outs or exclusions for ISSs that are already 
subject to stringent codes (i.e. CAP, IPSO and Ofcom VOD rules) that already have specific 


measures that take the needs of children in account and are consistent with the UNCRC. 


37. We would also request further clarification on how this Code relates to the Unfair Commercial 


Practices Directive, Audio-Visual Media Services Directive and relevant Competition laws. 


38. Should the Code be implemented, an appropriate implementation period should be put into place 
due to the potentially wide-ranging technical changes that would be required. Furthermore, we 
recommend that the ICO should conduct a technical and economic impact study, as well as a 


feasibility study before taking next steps. 


29 May 2019 
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